2020 CJEU ruling invalidating Privacy Shield and requiring case-by-case TIA for EU→US data transfers.
Schrems II (Case C-311/18, July 2020) invalidated the EU–US Privacy Shield framework and held that controllers using SCCs must verify the third country provides essentially equivalent protection — failing which, supplementary technical, contractual, or organisational measures are required.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.